CVE-2026-116135

A flaw was found in HTTP::Body. When processing URL-encoded form submissions, the module removes mixed-case percent escapes instead of decoding them into their corresponding characters. A remote attacker can exploit this parsing discrepancy by submitting specially crafted requests, potentially...

spark-rest-auth-bypass

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-rest-auth-bypass Write-up: https://abraxaslabs.tech/research/spark-rest-auth-bypass spark-rest-auth-bypass Class: Privilege leftover Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation...

CVE-2026-86794

The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated...

EUVD-2026-112632

The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated...

CVE-2026-115300 Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

WordPress Contact Form by Supsystic plugin < 1.11.1 - Contact Submission and Statistics Deletion vulnerability

Contact Submission and Statistics Deletion vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Contact Form by Supsystic versions 1.11.1...

CVE-2026-115300

The Contact Form by Supsystic WordPress plugin, in versions before 1.11.1 , is vulnerable to Cross-Site Request Forgery (CSRF) . The application fails to validate CSRF tokens or request origins on two specific administrator-only actions: bulk-deleting captured form submissions and wiping form sta...

CVE-2026-61529

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

CVE-2026-61529 Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

EUVD-2026-112410

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

CVE-2026-61529 Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

PT-2026-129171

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

PT-2026-130604

The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved. The module does not fully invalidate a solved CAPTCHA session. As a result, a...

CVE-2026-115480 baserCMS: Public Web API mail-form submission bypasses image CAPTCHA

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mailmessages/add/mailContentId.json endpoint accepts submissions without enforcing the form's authcaptcha setting. BcMail\Controller\Api\MailMessagesController::a...

CVE-2026-84921

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0...

CVE-2026-84921

The Webform Submissions Delete module for Drupal, affecting versions 0.0.0 through 1.2.0 , contains a Missing Authorization vulnerability. The root cause is that the module does not sufficiently restrict access to the delete form, allowing for Forceful Browsing . An unauthorized user can exploit ...

CVE-2026-84921 Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0...

CVE-2026-84921 Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0...

EUVD-2026-107866

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0...

Drupal Webform Submissions Delete authorization issue vulnerability

Drupal Webform Submissions Delete: Versions 0.0.0 through 1.2.0 contain an authorization issue vulnerability. This flaw stems from a lack of authorization validation, potentially allowing attackers to access unauthorized resources via forced browsing...